Merge branch 'develop' into 'master'

Added gen-game-web-instances/auguste-lambert to gitlab agents

See merge request ldc-web/cluster-k8s!133

.gitlab/agents/prod-k8s-ldc-web/config.yaml

@@ -2,6 +2,7 @@ ci_access:
   projects:
     - id: ldc-web/projets/agis
     - id: ldc-web/projets/auguste-lambert
+    - id: ldc-web/projets/bien-etre-animal
     - id: ldc-web/projets/boutique-cnc-sable
     - id: ldc-web/projets/boutique-jeusselin
     - id: ldc-web/projets/cailles-robin
@@ -12,8 +13,10 @@ ci_access:
     - id: ldc-web/projets/doux
     - id: ldc-web/projets/espri-restauration
     - id: ldc-web/projets/galina
+    - id: ldc-web/projets/gen-game-web-instances/auguste-lambert
     - id: ldc-web/projets/gen-game-web-instances/janze
     - id: ldc-web/projets/gen-game-web-instances/l-orleanais-jeu
+    - id: ldc-web/projets/gen-game-web-instances/le-gaulois-eveillez-vos-papilles
     - id: ldc-web/projets/gen-game-web-instances/le-gaulois-tdf-2024
     - id: ldc-web/projets/gen-game-web-instances/le-gaulois-chequier-40-2025
     - id: ldc-web/projets/gen-game-web-instances/le-gaulois-op-brasserie-2025
@@ -27,6 +30,7 @@ ci_access:
     - id: ldc-web/projets/gen-game-web-prize-draw
     - id: ldc-web/projets/id-halal
     - id: ldc-web/projets/jeusselin
+    - id: ldc-web/projets/ker-chant
     - id: ldc-web/projets/l-hours
     - id: ldc-web/projets/la-boutique-du-canard
     - id: ldc-web/projets/la-toque-angevine
@@ -55,6 +59,7 @@ ci_access:
     - id: ldc-web/projets/parc-auto
     - id: ldc-web/projets/poule-et-toque
     - id: ldc-web/projets/prims
+    - id: ldc-web/projets/qualimaine
     - id: ldc-web/projets/qrcollector/qrcollector-back
     - id: ldc-web/projets/regalette
     - id: ldc-web/projets/reghalal

flux/kustomizations/crowdsec.yaml

@@ -0,0 +1,32 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: crowdsec
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  path: ./infrastructure/crowdsec
+  prune: false
+  healthChecks:
+    - apiVersion: source.toolkit.fluxcd.io/v1
+      kind: HelmRepository
+      name: crowdsec
+      namespace: common-services
+    - apiVersion: helm.toolkit.fluxcd.io/v2
+      kind: HelmRelease
+      name: crowdsec
+      namespace: common-services
+    - apiVersion: v1
+      kind: Pod
+      name: vault-0
+      namespace: common-services
+  dependsOn:
+    - name: namespaces
+      namespace: flux-system
+    - name: external-secrets-resources
+      namespace: flux-system
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  timeout: 5m

flux/kustomizations/kustomization.yaml

@@ -14,3 +14,4 @@ resources:
   - traefik.yaml
   - quickchart.yaml
   - netdata.yaml
+  - crowdsec.yaml

infrastructure/crowdsec/helm-release.yaml

@@ -0,0 +1,92 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: crowdsec
+  namespace: common-services
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: crowdsec
+      version: 0.24.0
+      sourceRef:
+        kind: HelmRepository
+        name: crowdsec
+        namespace: common-services
+  values:
+    container_runtime: containerd
+
+    image:
+      tag: v1.7.8
+
+    agent:
+      acquisition:
+        - namespace: common-services
+          podName: traefik-*
+          program: traefik
+      env:
+        - name: COLLECTIONS
+          value: "crowdsecurity/traefik"
+
+    secrets:
+      externalSecret:
+        name: crowdsec-lapi-secret
+        csLapiSecretKey: "CS_LAPI_SECRET"
+        registrationTokenKey: "REGISTRATION_TOKEN"
+
+    lapi:
+      replicas: 2
+      storeCAPICredentialsInSecret: true
+      storeLAPICscliCredentialsInSecret: true
+      persistentVolume:
+        data:
+          enabled: false
+        config:
+          enabled: false
+      envFrom:
+        - secretRef:
+            name: crowdsec-lapi-secret
+
+    config:
+      config.yaml.local: |
+        api:
+          client:
+            # the log processor will remove delete itself from LAPI when stopping.    
+            unregister_on_exit: true
+          server:
+            auto_registration: # Activate if not using TLS for authentication
+              enabled: true
+              token: "${CROWDSEC_REGISTRATION_TOKEN}" # /!\ Do not modify this variable (Cluster K8S gitlab var)
+              allowed_ranges: # /!\ Make sure to adapt to the pod IP ranges used by your cluster
+                - "127.0.0.1/32"
+                - "192.168.0.0/16"
+                - "10.0.0.0/8"
+                - "172.16.0.0/12"
+        db_config:
+          type: mysql
+          user: ${CROWDSEC_DB_USER}
+          password: ${CROWDSEC_DB_PWD}
+          db_name: ${CROWDSEC_DB_NAME}
+          host: ${DB_HOST}
+          port: ${DB_PORT}
+          flush:
+            bouncers_autodelete:
+              api_key: 1h
+            agents_autodelete:
+              login_password: 6h
+              cert: 6h
+
+    appsec:
+      enabled: true
+      acquisitions:
+        - source: appsec
+          listen_addr: "0.0.0.0:7422"
+          path: /
+          appsec_configs:
+            - crowdsecurity/appsec-default
+            - crowdsecurity/crs
+          labels:
+            type: appsec
+      env:
+        - name: COLLECTIONS
+          value: "crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-crs crowdsecurity/appsec-generic-rules"

infrastructure/crowdsec/helm-repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: crowdsec
+  namespace: common-services
+spec:
+  interval: 1h0m0s
+  url: https://crowdsecurity.github.io/helm-charts

infrastructure/crowdsec/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helm-repository.yaml
+  - helm-release.yaml

infrastructure/gitlab-agent/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: gitlab-agent
-      version: 2.20.1
+      version: 2.29.0
       sourceRef:
         kind: HelmRepository
         name: gitlab-agent
@@ -17,7 +17,7 @@ spec:
   values:
 
     image:
-      tag: v18.5.2
+      tag: v19.2.0
 
     config:
       kasAddress: "wss://lab.s-web.fr/-/kubernetes-agent/"

infrastructure/gitlab-runner/helm-release.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: gitlab-runner
-      version: 0.82.0
+      version: 0.91.2
       sourceRef:
         kind: HelmRepository
         name: gitlab-runner
@@ -17,7 +17,7 @@ spec:
   values:
 
     image:
-      tag: alpine-v18.5.0
+      tag: alpine-v19.2.2
 
     gitlabUrl: https://lab.s-web.fr
 

infrastructure/hashicorp-vault/external-secrets/resources/crowdsec.yaml

@@ -0,0 +1,38 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: crowdsec-lapi-secret
+  namespace: common-services
+spec:
+  refreshInterval: 15s
+  secretStoreRef:
+    name: vault-secret-store
+    kind: ClusterSecretStore
+  target:
+    name: crowdsec-lapi-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: CS_LAPI_SECRET
+      remoteRef:
+        key: secret/data/crowdsec/lapi
+        property: CS_LAPI_SECRET
+    - secretKey: REGISTRATION_TOKEN
+      remoteRef:
+        key: secret/data/crowdsec/lapi
+        property: REGISTRATION_TOKEN
+    - secretKey: ENROLL_KEY
+      remoteRef:
+        key: secret/data/crowdsec/lapi
+        property: ENROLL_KEY
+    - secretKey: ENROLL_INSTANCE_NAME
+      remoteRef:
+        key: secret/data/crowdsec/lapi
+        property: ENROLL_INSTANCE_NAME
+    - secretKey: ENROLL_TAGS
+      remoteRef:
+        key: secret/data/crowdsec/lapi
+        property: ENROLL_TAGS
+    - secretKey: BOUNCER_KEY_traefik
+      remoteRef:
+        key: secret/data/crowdsec/lapi
+        property: BOUNCER_KEY_traefik

infrastructure/hashicorp-vault/external-secrets/resources/kustomization.yaml

@@ -12,4 +12,5 @@ resources:
   - staging.yaml
   - production.yaml
   - rabbitmq.yaml
-  - netdata.yaml
+  - netdata.yaml
+  - crowdsec.yaml

infrastructure/traefik/helm-release.yaml

@@ -33,7 +33,9 @@ spec:
       - "--entryPoints.websecure.forwardedHeaders.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
 
     additionalArguments:
-      - "--log.level=DEBUG"
+      #- "--log.level=DEBUG"
+      - "--entrypoints.web.http.middlewares=common-services-crowdsec-bouncer@kubernetescrd"
+      - "--entrypoints.websecure.http.middlewares=common-services-crowdsec-bouncer@kubernetescrd"
 
     deployment:
       replicas: 2
@@ -83,6 +85,18 @@ spec:
       kubernetesIngress:
         enabled: true
 
+    experimental:
+      plugins:
+        bouncer:
+          moduleName: github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
+          version: v1.4.5
+
+    volumes:
+      - name: crowdsec-lapi-secret
+        mountPath: /etc/traefik/crowdsec
+        type: secret
+        secretName: crowdsec-lapi-secret
+
     service:
       enabled: true
       type: LoadBalancer
@@ -93,7 +107,6 @@ spec:
         # Protection Flux : empêche la suppression accidentelle
         kustomize.toolkit.fluxcd.io/prune: disabled
       spec:
-        loadBalancerIP: "${TRAEFIK_LOAD_BALANCER_IP_OCTAVIA}"
         externalTrafficPolicy: Local
 
     ingressRoute:
@@ -101,6 +114,28 @@ spec:
         enabled: true
 
     extraObjects:
+      - apiVersion: traefik.io/v1alpha1
+        kind: Middleware
+        metadata:
+          name: crowdsec-bouncer
+          namespace: common-services
+        spec:
+          plugin:
+            bouncer:
+              forwardedHeadersTrustedIps: "${OVH_LOAD_BALANCER_EGRESS_IP}/32"
+              enabled: true
+              crowdsecMode: stream
+              crowdsecLapiScheme: http
+              crowdsecLapiHost: crowdsec-service.common-services.svc.cluster.local:8080
+              crowdsecLapiPath: /
+              crowdsecLapiKeyFile: /etc/traefik/crowdsec/BOUNCER_KEY_traefik
+              crowdsecAppsecEnabled: true
+              crowdsecAppsecHost: crowdsec-appsec-service.common-services.svc.cluster.local:7422
+              crowdsecAppsecPath: /
+              crowdsecAppsecFailureBlock: true
+              crowdsecAppsecUnreachableBlock: true
+              crowdsecAppsecBodyLimit: 10485760
+
       - apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
         kind: Middleware
         metadata:
@@ -332,6 +367,38 @@ spec:
               - 168.119.123.75 # UptimeRobot
               - 78.46.215.1 # UptimeRobot
               - 91.99.101.207 # UptimeRobot
+              - 46.224.188.186 # BugSmash
+              - 178.156.178.124 # BugSmash
+              - 5.161.29.18 # BugSmash
+
+      # AJOUT : Service Octavia en parallèle
+      - apiVersion: v1
+        kind: Service
+        metadata:
+          name: traefik-octavia
+          namespace: common-services
+          annotations:
+            loadbalancer.ovhcloud.com/class: "octavia"
+            loadbalancer.openstack.org/proxy-protocol: "v2"
+            loadbalancer.openstack.org/keep-floatingip: "true"
+            # Protection Flux : empêche la suppression accidentelle
+            kustomize.toolkit.fluxcd.io/prune: disabled
+        spec:
+          type: LoadBalancer
+          externalTrafficPolicy: Local
+          loadBalancerIP: "${TRAEFIK_LOAD_BALANCER_IP_OCTAVIA}"
+          selector:
+            app.kubernetes.io/name: traefik
+            app.kubernetes.io/instance: traefik-common-services
+          ports:
+            - name: web
+              port: 80
+              targetPort: 8000
+              protocol: TCP
+            - name: websecure
+              port: 443
+              targetPort: 8443
+              protocol: TCP
 
       - apiVersion: v1
         kind: Service
@@ -368,7 +435,25 @@ spec:
           routes:
             - kind: Rule
               match: >-
-                ClientIP(`45.88.138.45/32`)
+                ClientIP(`45.88.138.45/32`) ||
+                ClientIP(`8.34.210.32/32`) ||
+                ClientIP(`8.34.210.37/32`) ||
+                ClientIP(`8.34.210.42/32`) ||
+                ClientIP(`8.34.210.43/32`) ||
+                ClientIP(`8.34.210.45/32`) ||
+                ClientIP(`34.68.34.65/32`) ||
+                ClientIP(`34.68.34.66/32`) ||
+                ClientIP(`34.68.34.67/32`) ||
+                ClientIP(`34.68.34.69/32`) ||
+                ClientIP(`34.68.34.71/32`) ||
+                ClientIP(`34.68.34.72/32`) ||
+                ClientIP(`34.68.34.77/32`) ||
+                ClientIP(`34.68.34.79/32`) ||
+                ClientIP(`34.68.34.81/32`) ||
+                ClientIP(`34.68.34.84/32`) ||
+                ClientIP(`94.74.106.96/32`) ||
+                ClientIP(`20.220.225.223/32`) ||
+                ClientIP(`52.182.173.140/32`)
               priority: 100000
               middlewares:
                 - name: deny-ip-blocklist